/**
 * Secrets 模块 API
 * 密钥管理相关接口
 */

import { request, type ApiResponse, type RequestParamValue } from "../request";

// ============ 类型定义 ============

/**
 * API Key 类型
 */
export type ApiKeyType = "legacy" | "publishable" | "secret";

/**
 * API Key 响应
 */
export interface ApiKeyResponse {
	api_key?: string | null;
	id?: string | null;
	type?: ApiKeyType | null;
	prefix?: string | null;
	name: string;
	description?: string | null;
	hash?: string | null;
	secret_jwt_template?: Record<string, unknown> | null;
	inserted_at?: string | null;
	updated_at?: string | null;
}

/**
 * 创建 API Key 请求体
 */
export interface CreateApiKeyBody {
	type: "publishable" | "secret";
	name: string;
	description?: string | null;
	secret_jwt_template?: Record<string, unknown> | null;
}

/**
 * 更新 API Key 请求体
 */
export interface UpdateApiKeyBody {
	name?: string;
	description?: string | null;
	secret_jwt_template?: Record<string, unknown> | null;
}

/**
 * Legacy API Keys 响应
 */
export interface LegacyApiKeysResponse {
	enabled: boolean;
}

/**
 * Pgsodium 配置响应
 */
export interface PgsodiumConfigResponse {
	root_key: string;
}

/**
 * 更新 Pgsodium 配置请求体
 */
export interface UpdatePgsodiumConfigBody {
	root_key: string;
}

/**
 * Secret 响应
 */
export interface SecretResponse {
	name: string;
	value: string;
	updated_at?: string;
}

/**
 * 创建 Secret 项
 */
export interface CreateSecretItem {
	name: string;
	value: string;
}

// ============ API 方法 ============

/**
 * 获取项目 API Keys
 */
export function getApiKeys(
	ref: string,
	reveal?: boolean
): Promise<ApiResponse<ApiKeyResponse[]>> {
	return request.get<ApiKeyResponse[]>(
		`/v1/projects/${ref}/api-keys`,
		reveal !== undefined ? { reveal } : undefined
	);
}

/**
 * 创建新的 API Key
 */
export function createApiKey(
	ref: string,
	data: CreateApiKeyBody,
	reveal?: boolean
): Promise<ApiResponse<ApiKeyResponse>> {
	return request.post<ApiKeyResponse>(
		`/v1/projects/${ref}/api-keys`,
		data,
		{ params: reveal !== undefined ? { reveal } : undefined }
	);
}

/**
 * 检查 Legacy API Keys 是否启用
 */
export function getLegacyApiKeys(
	ref: string
): Promise<ApiResponse<LegacyApiKeysResponse>> {
	return request.get<LegacyApiKeysResponse>(
		`/v1/projects/${ref}/api-keys/legacy`
	);
}

/**
 * 禁用或重新启用 Legacy API Keys
 */
export function updateLegacyApiKeys(
	ref: string,
	enabled: boolean
): Promise<ApiResponse<LegacyApiKeysResponse>> {
	return request.put<LegacyApiKeysResponse>(
		`/v1/projects/${ref}/api-keys/legacy`,
		undefined,
		{ params: { enabled } }
	);
}

/**
 * 更新 API Key
 */
export function updateApiKey(
	ref: string,
	id: string,
	data: UpdateApiKeyBody,
	reveal?: boolean
): Promise<ApiResponse<ApiKeyResponse>> {
	return request.patch<ApiKeyResponse>(
		`/v1/projects/${ref}/api-keys/${id}`,
		data,
		{ params: reveal !== undefined ? { reveal } : undefined }
	);
}

/**
 * 获取指定 API Key
 */
export function getApiKey(
	ref: string,
	id: string,
	reveal?: boolean
): Promise<ApiResponse<ApiKeyResponse>> {
	return request.get<ApiKeyResponse>(
		`/v1/projects/${ref}/api-keys/${id}`,
		reveal !== undefined ? { reveal } : undefined
	);
}

/**
 * 删除 API Key
 */
export function deleteApiKey(
	ref: string,
	id: string,
	options?: {
		reveal?: boolean;
		was_compromised?: boolean;
		reason?: string;
	}
): Promise<ApiResponse<ApiKeyResponse>> {
	return request.delete<ApiKeyResponse>(
		`/v1/projects/${ref}/api-keys/${id}`,
		undefined,
		{ params: options as Record<string, RequestParamValue> }
	);
}

/**
 * 获取项目 Pgsodium 配置（Beta）
 */
export function getPgsodiumConfig(
	ref: string
): Promise<ApiResponse<PgsodiumConfigResponse>> {
	return request.get<PgsodiumConfigResponse>(
		`/v1/projects/${ref}/pgsodium`
	);
}

/**
 * 更新项目 Pgsodium 配置（Beta）
 * 警告：更新 root_key 可能导致使用旧密钥加密的所有数据无法访问
 */
export function updatePgsodiumConfig(
	ref: string,
	data: UpdatePgsodiumConfigBody
): Promise<ApiResponse<PgsodiumConfigResponse>> {
	return request.put<PgsodiumConfigResponse>(
		`/v1/projects/${ref}/pgsodium`,
		data
	);
}

/**
 * 列出所有 Secrets
 */
export function listSecrets(
	ref: string
): Promise<ApiResponse<SecretResponse[]>> {
	return request.get<SecretResponse[]>(
		`/v1/projects/${ref}/secrets`
	);
}

/**
 * 批量创建 Secrets
 */
export function bulkCreateSecrets(
	ref: string,
	secrets: CreateSecretItem[]
): Promise<ApiResponse<Record<string, unknown>>> {
	return request.post<Record<string, unknown>>(
		`/v1/projects/${ref}/secrets`,
		secrets
	);
}

/**
 * 批量删除 Secrets
 */
export function bulkDeleteSecrets(
	ref: string,
	names: string[]
): Promise<ApiResponse<Record<string, unknown>>> {
	return request.delete<Record<string, unknown>>(
		`/v1/projects/${ref}/secrets`,
		names
	);
}

export default {
	getApiKeys,
	createApiKey,
	getLegacyApiKeys,
	updateLegacyApiKeys,
	updateApiKey,
	getApiKey,
	deleteApiKey,
	getPgsodiumConfig,
	updatePgsodiumConfig,
	listSecrets,
	bulkCreateSecrets,
	bulkDeleteSecrets
};
